Re: [PATCH v3 2/2] iio: gyro: mpu3050: add missing trigger cleanup on remove()

[Nuno Sá]

On Sat, Oct 17, 2026 at 07:19:21AM +0200, Joshua Crofts wrote:
> The mpu3050_trigger_probe() registers a trigger but
> mpu3050_common_remove() and error paths in mpu3050_common_probe() forget
> to clean it up, causing a use-after-free bug.
> 
> Add the missing calls to the iio_trigger_unregister() function.
> 
> Reported-by: Dingisoul <dingiso.kernel@xxxxxxxxx>
> Closes: https://lore.kernel.org/all/20261010203601.1686148-1-dingiso.kernel@xxxxxxxxx/
> Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Joshua Crofts <joshua.crofts1@xxxxxxxxx>
> ---
>  drivers/iio/gyro/mpu3050-core.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
> index 879caf3b729c..9e747836df3e 100644
> --- a/drivers/iio/gyro/mpu3050-core.c
> +++ b/drivers/iio/gyro/mpu3050-core.c
> @@ -1262,7 +1262,9 @@ int mpu3050_common_probe(struct device *dev,
>  	pm_runtime_get_sync(dev);
>  	pm_runtime_put_noidle(dev);
>  	pm_runtime_disable(dev);
> -	if (irq)
> +	if (mpu3050->trig)
> +		iio_trigger_unregister(mpu3050->trig);

Yeah, I think sashiko is right... I think we can just reuse the if
(mpu3050->irq) condition for unregistering  but then this patch depends
on the previous one. And such dependencies can be set for stable so
don't think it's an issue.

I already pointed it out and Jonathan seems to have said the same. If
you do have the time, converting the whole thing to devm would be nice 
- could be patch 3 :)

- Nuno Sá

> +	if (mpu3050->irq)
>  		free_irq(mpu3050->irq, mpu3050->trig);
>  err_cleanup_buffer:
>  	iio_triggered_buffer_cleanup(indio_dev);
> @@ -1281,6 +1283,8 @@ void mpu3050_common_remove(struct device *dev)
>  	pm_runtime_get_sync(dev);
>  	pm_runtime_put_noidle(dev);
>  	pm_runtime_disable(dev);
> +	if (mpu3050->trig)
> +		iio_trigger_unregister(mpu3050->trig);
>  	if (mpu3050->irq)
>  		free_irq(mpu3050->irq, mpu3050->trig);
>  	iio_triggered_buffer_cleanup(indio_dev);
> 
> -- 
> 2.56.0
>